Be a man and say no, most of these "hackers" are just children, especially one who wants his friend to have admin on your probably generic server. Even if something does happen it will go away in a short while.

I can say I can DDOS you too, does that makes it true? Anyone can lie out their ass, its up to you to call their bluff. If it does happen you can just change your name and ip, its not like they can follow you easily. Be warned, they might actually be able to, be ready to take the necessary defensive actions if they can.

Welp, there's always the possibility he isn't lying. If so, look up his name on Google and find his Steam profile, copy and paste the url here http://steamidfinder.com/ and get his Steam ID from that. You can either a) report him to Valve or b) acquire his IP address by googling his Steam ID and you'll see in those preview words under the links, some will have his IP address in it. Click whatever link does and attain his IP. Do whatever you need with it.

Call your hoster. You PAY for support and the hoster has the responsibility to prevent DDoS attacks. If he doesn't, it is not your problem and I wouldn't pay shit for the additional traffic. BTW: In my country, the penalty for DDoSing is from a huge money penalty to 3 years in prison. You have the Steam ID, Valve has the real name, your hoster has huge costs if the guy is really serious. Even if you don't have enough evidences, a nice letter is enough to give him some nice shivers and bad dreams and properly bring him (or properly, and more likely, his parents) to pay.

DDoSing is no fucking game... 2 days downtimes of the whole infrastructure and a company can be ruined.

Call your hoster. You PAY for support and the hoster has the responsibility to prevent DDoS attacks. If he doesn't, it is not your problem and I wouldn't pay shit for the additional traffic. BTW: In my country, the penalty for DDoSing is from a huge money penalty to 3 years in prison. You have the Steam ID, Valve has the real name, your hoster has huge costs if the guy is really serious. Even if you don't have enough evidences, a nice letter is enough to give him some nice shivers and bad dreams and properly bring him (or properly, and more likely, his parents) to pay.

DDoSing is no fucking game... 2 days downtimes of the whole infrastructure and a company can be ruined.

Find me some solid cases where a person has been convicted of DDoS, or threatening to DDoS a game server?
If you even google news ddos arrested -anonymous you get 2 results, which are actually to do with anonymous anyway...

Hosts do NOT have a responsibility to prevent DDoS. You cannot Prevent a DDoS, only mitigate and they don't have to do that either.
They provide what they say they provide. Even if they claim to provide DDoS protection it will have limitations to which there not responsible for if they exceed.